New Criterion Says AI Logs Aren't Enough for Legal Oversight

A new technical report from Jeroen Janssen tackles a critical gap in AI governance: how can we trust runtime records from agentic AI systems as legal evidence? The paper, published on arXiv, defines an evidentiary-adequacy criterion specifically for binary factual determinations—for example, whether protected data crossed a boundary, whether a human could have intervened, or whether delegated authority was valid. The criterion states that a runtime record must carry both a typing that maps recorded events to a legally operative category and the specific relation (provenance, authority, derivation, or temporal validity) on which the finding's truth depends. The claim is one of necessity, not sufficiency.

The report instantiates this criterion against selected EU AI Act oversight obligations, demonstrating why tamper-proof logs, generic process frameworks, and provenance structures alone cannot establish the required legal findings. It further connects the argument to cybernetic concepts like requisite variety and the Good Regulator Theorem, as well as the trace-versus-hyperproperty boundary of runtime verification. For professionals deploying or auditing agentic AI, this means that simply collecting logs is insufficient for legal compliance—each potential legal finding must be explicitly designed into the record-keeping architecture. The 12-page report and companion materials are archived on Zenodo.